ℹ️ CIO Week: Fireside Chat with Jordan Hager

Hello everyone. Welcome to Cloudflare TV. My name is Anika.

I'm on the product team here at Cloudflare and this is CIO Week, Cloudflare's last innovation week of the year where we're spending it highlighting and celebrating new products and features of the Cloudflare One platform that can help CIOs build their next generation networks on Cloudflare.

And today is part of CIO Week.

I'm super excited to be joined by our featured guest for today, Jordan Hager, who's the vice president of hosting architecture at Q2 Software.

Jordan, thanks so much for joining us.

Very excited to have you here.

I'd love to just kick off by if you could tell us a little bit about yourself, about your background, sort of your career journey, how you ended up where you are today.

Yeah, thanks, Annika.

Happy to be here.

I'm excited.

Really cool opportunity and hello to everybody out there watching.

Thought I should mention, my name is Jordan Hager and by title, I am the vice president of hosting at Q2.

I have the distinct pleasure of leading the hosting organization, a team of about 100 engineers and architects for Q2 Software.

Just a little bit again about my background, as Annika said, my background is in IT.

I came to Austin, Texas to work for Q2 back in 2011, ten years ago, just a little just eclipsed my ten year anniversary.

I took a little bit of a different path.

I actually came through the support organization.

I was the leader of support for about three years, a phenomenal opportunity to learn more about our industry, our customers.

I gave some excellent and just really some invaluable firsthand knowledge of our product and transitioned over kind of back to my roots, if you will, to the hosting organization where I built our 24/7/365 operations center, obviously with the help of a whole bunch of people that we don't have time to mention.

But I did that for about three years and then really had a host of different roles at Q2, which has kept things new, refreshing and exciting for me.

But my role here again today is over the last three years is leading the hosting organization, really focused on architecture, core engineering and our DevOps organizations.

Gotcha.

Awesome. And we have folks listening from all over the world, lots of different industries and backgrounds.

Can you tell us a little bit more about Q2 in general, what is sort of the mission of the company?

And then maybe also what does your team do specifically to serve that mission?

Yeah, I would love to.

I think very proud of our mission, really.

Our mission, as we say, is to build strong and diverse communities by building strong financial institutions that serve those communities.

So if you really kind of decompose that or break that down, our mantra or our charter is to deliver innovative solutions and products to financial services and fintech organizations or institutions.

Globally, we have about 800 clients globally, 450 different financial institutions here in the United States, about 20 just a little over 20 million users on the platform.

Really, again, we look at technology as the great equalizer that allows our clients, again, banks, credit unions, fintech companies to compete against some of the larger banks, both here domestically, but also globally.

Really, we believe that people want financial freedom.

They want choices with who they bank with.

And really, technology is a great equalizer, allows our clients to compete.

We also believe that when we keep money local to the community, that those institutions contribute back to the community through charitable donations, fundraisers.

Just all in all, I think better for communities and helps really empower those communities.

That's amazing.

I love the way that you phrase that mission with the focus on community first.

That's so grounding and I can imagine it inspiring for the team and technology is a great equalizer.

That's a great sort of pillar, too.

Cool.

So you're the VP of hosting. What is your team thinking about with that mission in mind?

What are your top priorities these days?

How do you think about success, especially as Q2 continues to grow?

And I know you're super fast growing company as well.

Yeah, scale is certainly been our number one challenge.

Again, moving from about 2013, we had about 3 million users on our platform.

We'll exit this year with just about 21 million users.

So substantial growth.

I'd like to think of that as the success that not only we have recognized as an organization, but that our customers have recognized within their own businesses.

My teams really are focused on a number of things.

It's a big question, but really service delivery and given the industry we're in, security are probably principal or chief amongst that.

The things that we're really uber focused on really starting a service delivery and we'll get into a little bit more of the architecture.

But I think obviously as the digital channel has evolved and what I mean by the digital channel, if you think about traditional banking ten years ago, 15 years ago, very normal, very natural for people to walk into branches.

Now, as digital transformation, everybody's gone online.

We're certainly not unique in that regard, but that is really driven the scale.

And again, to give you a sense for the magnitude of that, we move about $2.2 trillion worth of money through our platform on an annual basis as well.

And that's just been, again, exponential growth over the last seven, eight years.

So really, with all of that, again, that's to emphasize, I think the expectations on service delivery, making sure our platform is up really enables, I think, our customers to focus on innovation and strategy, which is where we want them focused on.

That's ultimately what enables them to buy solutions from us as well.

Security is also obviously core. I think we'll spend a little bit of time talking about security today and really how the landscape of security has changed.

Really, the perimeter has changed, obviously, with the pandemic as well.

But there's an alliance of or customers expect that obviously security is core to what we deliver as well.

So service delivery, security and then really helping our development partnership software quickly getting innovation into the hands of our customers is ultimately one of our more critical functions as well.

Yeah, makes sense.

And there's a lot of stuff in there, obviously.

How does your team think about all of those different things at once, what success actually means?

Right?

Like, what does it mean to keep your platform reliable and available and secure?

How do you how do you actually measure that? Yeah, I'm a good question.

Again, I think there's an assumption that any time anywhere really is how people bank nowadays.

So there's the platform should be up 24/7/365. And that's a that's an obligation that we take seriously.

It's an expectation that we know our customers have of us.

And that is completely fine with us in terms of how we measure success, obviously.

I should say traditionally, I think we measure success through affiliates, really.

And the number of minutes in a month, the number of minutes in a year that the platform is available.

However, I think with customer expectations shifting with again, acceleration of digital transformation, the customer experience is what it's all about.

Now the platform to be available on the platform can be up, but if it's not performance for not delivering all of the features that really create the experience within the platform, our customers are super attuned to any type of disruption beyond just availability.

So really a shift in an evolution from availability to customer experience is how we start to measure that a little bit differently is one of our challenges here in 22 and beyond.

Other success metrics.

Again, I'm always hesitant to toot our home too much, but really I think our execution around security, I think, speaks for itself.

I'm very proud of the work that the team has done.

And again, I'm not going to go too far around pounding our chests, but again, we're happy with the work that we've done.

Security is a challenging landscape, always shifting, ever more challenging all the time.

But that is again, that's that's certainly a metric that we measure when we're very proud of as well.

Awesome.

makes sense. Yeah.

I mean, we've talked a little bit about the changes and you mentioned digital transformation being a big shift.

I definitely can imagine, especially in banking, this has been super dramatic and especially as you're mentioning.

Are you working with a lot of clients that are sort of serving their local communities, smaller credit unions, things like that, like the ability for them to use technology to make those transitions is got to be really critical.

What other stuff?

I mean, obviously the pandemic has been huge, but what other things in sort of in sort of macro level trends or shifts has your team kind of had to deal with over the ten years that you've been at Q2, and what are you thinking about in terms of preparing for the next big ones?

Yeah, great question.

You touched on the pandemic, and I'll come back to that here in just a minute.

But again, Q2 has been in business since 2004.

Headquartered out of Austin, Texas, and really started by a group, a very small group of folks that launched the company.

It took about seven years for us to really take off, probably a little less now, but about seven years for the business to really take off.

I joined again in 2011 and you and I, prior to this, you asked me to speak to you to really it's just the ever changing evolution of the company.

I mean, to go from where we were as 175 person organization ten years ago to now over 2200 people on strong, a talented group of engineers, we have seen tremendous, as you may imagine, tremendous change in the company.

We've gone through an IPO again.

We're fortunate to be able to do that as an organization now into mergers and acquisitions, as an as a publicly traded company that's now become global.

So you can imagine just through that natural growth, there comes a lot of unique challenges.

Let's see, some of the more unique challenges is again ever changing expectations of customers.

And we embrace that.

We welcome that.

That's what we've stay in front of. Again, I think what customers expected ten years ago, even five years ago versus what they expect today are two very different things.

And again, that's all the result of, I think, a lot of success and a lot of evolution of software and technology in general.

Another one here is obviously as we become a global workforce, those present new and unique challenges that really happened through the course of merger and acquisition.

And we'll get to the importance, I think, of where Cloudflare really plugs into our merger acquisition strategy here a little bit towards the end of this talk.

But when you go through that very natural evolution as an enterprise and there's a there's a quote here that I saw in an article the other day that 76% of all enterprises that go through a merger and acquisition phase of their company's evolution end up in this multi-cloud hybrid cloud scenario that also creates this called a pantry of technologies that you have to learn how to operate and live with.

And again, that's very operationally difficult and challenging for teams to get their arms around.

And that's something that, again, we've probably lived for the better part of the last four or five years is we've gone into merger acquisition.

A distributed and remote workforce now is probably central to one of the bigger challenges that we have.

Again, that creates unique security challenges, but probably more importantly creates really interesting and different cultural challenges and how we lead as leaders, how we keep people engaged.

Again, we have a saying here that people work for people and remaining close and creating and maintaining that connection certainly not impossible, but I think exercise is new and different muscles for us as leaders that we've got to now develop and we've got to develop really, really quickly in a very, very competitive talent acquisition landscape, if you were where everyone's competing for a lot of the same talent.

So that's probably the one thing that keeps me up at night is our ability to attract, retain and keep our talent challenge challenged and interested in the work that they're doing every day.

Yeah.

Got it. That makes a lot of sense.

So you brought up two sort of big things that your organization has been going through the remote work and and sort of the mergers and acquisitions.

What have you learned?

So we've been through two years, almost more than that going on of primarily remote work, or at least that's been the case for a lot of organizations.

And then I can imagine since becoming a public company, more M&A activity.

What kinds of things have you learned from those experiences that are informing what the next maybe five years at Q two is going to look like and curious, both on the technical side and in terms of sort of the culture aspects that you were mentioning just now, what have you learned that's enabling you to continue to keep your team engaged, excited about the work they're doing?

Yeah.

I'll provide a more robust response. But I think in a nutshell, embrace change is probably one of the things that we've learned over the last five years.

And really whether that's changed within our business or changed within our world, I mean, embracing change is so important right now.

And that's probably the one thing that we'll have to continue to reinforce with our workforces is, again, just to continue to embrace change.

Because I think as you grow as quickly as we have and we'll continue to grow, you can't build for 2x, 5x, 10x.

So we're constantly tweaking, tuning and rebuilding beyond that.

Again, I think, as I mentioned before, how we've developed new muscles as leaders, how we keep people engaged, that is certainly one of our bigger areas of focus.

Really, I don't want to call it a challenge.

It's a good thing, but that's where we'll focus heavily in 2022 in terms of just other challenges and priorities and issues for us.

Cloudflare again really distributed cloud and our architecture and how we're building for new architecture in this very now normal, multi-cloud world is probably, if not the most important thing for us in 2022.

It's certainly one of the top three.

So as we continue to bring together this ecosystem of products across multiple public clouds in this merger acquisition phase that we're in, the ability to do that under what I call this ubiquitous plain or central centralized platform, really that is core to what Cloudflare is doing for Q2 today is it's providing that consistent network edge and security edge that allows us to bring all of our cloud environments in under really one call it umbrella.

That's super great to hear.

Yeah, that definitely we hear that from customers that are going through the cloud transition, whether that's with M&A activities or just trying to pursue a multi-cloud strategy as they maybe migrate from legacy architectures, whether you're doing a multi cloud thing or poly cloud having a single control plane for security, something that comes up for us a ton as a place where you can have value.

So that's great to hear.

Curious in terms of security, we just mentioned one sort of tenant, which is having the one control plane across everything that you're doing.

But what kind of other frameworks or guidelines is your team thinking about in terms of security?

And how has that actually changed over time with the additions or the changes and things like distributed work and multi-cloud?

Yeah, good question.

Certainly has made things more challenging. I mentioned perimeter earlier and again, I think the traditional perimeter when we were all coming into the office was a pretty predictable perimeter that really probably involved a few satellite offices or branch offices, a corporate office, a public cloud and a private data center.

And again, that was pretty predictable.

We really knew for the most part where our perimeter was.

All of a sudden, you take 2000 employees and you tell them, go home and work, and oh, by the way, it doesn't matter where you work, you can actually work not just from your home, but from a coffee shop or a different state, really.

That presents new and challenging opportunities for us.

Again, those are things that, again, not only did they happen to happen overnight.

So and again, those are things that I think not only Q2 was dealing with.

I was, for the better part, what the world was dealing with.

But again, I think it really changed how we define our perimeter, really.

We were also in the very early phases of the Cloudflare implementation when that happened.

And again, I think almost fortunately we're in this position where we knew that our perimeter, that our network edge was about to change anyway.

So all of a sudden now I think you've seen really this acceleration of companies in zero trust space.

Zero trust, I think means something different, unfortunately to everybody.

Everybody has their own definition of zero trust and it's probably oftentimes misused, but certainly zero trust becomes core, really a critical tenant of how we now secure our edge.

That's absolutely one of the things we're focused on.

There's as I also mentioned, our customers assume that there is very strong controls around data security.

So how we secure data, really how we make data almost immutable so that even if in the event of a security incident, we know what was accessed and really that more than likely the data that was accessed was of no value to anybody who had access to it.

So zero trust is certainly really important. Data security is probably right behind that.

Yeah, I'd love to dig into that a little bit more.

You just mentioned Zero Trust.

People have lots of different definitions and it's kind of this buzzword that's blown up a little bit and people use all kinds of different things to fit into that category.

But when you think about that and you're thinking about like, if we want to take a zero trust approach for our architecture, or maybe we can frame it as how would you advise maybe other people also that are in your role that are starting to think about Zero Trust for the first time?

What does that actually mean to you and how is that sort of change the approach that you're taking to your network architecture?

Yeah, that's a great question and I certainly won't stand here in front of the group here and pretend to be a zero trust expert, let alone a security practitioner.

So a little bit over my skis when we start to talk about this.

Fortunately, I think for Q2 and our customers, I've got some really smart people that are probably much better at talking about this than me.

But I think at its core, there are multiple tenants of zero trust, but at its core, really it's lack of implied trust.

We're not trusting anybody.

There is no implied trust here.

So the notion of leveraging things like ACLs, that's pretty antiquated approach to how we protect the perimeter.

Really, this now becomes authentication through multifactor authentication, two factor authentication, leveraging tokens for authentication versus service accounts or versus traditional credentials.

So I think that's probably where I start.

I know Cloudflare has got some really exciting things on the roadmap relative to Zero Trust.

Those are certainly things we're evaluating as well. We actually just had a conversation earlier today about Agent VPNs, the use of VPNs and how I think the industry is moving away from the traditional VPN agent or client.

And again, I think Cloudflare probably plays very well into our roadmap as it relates to agent.

Awesome.

That's great to hear. Yeah, I'd love to talk a little bit more about the relationship with Cloudflare in general.

You mentioned you were sort of like in the beginning of rollout with Cloudflare when the pandemic hit.

Can you, let's just talk about that a little bit more.

Like, when did you start?

When did you become aware of Cloudflare?

When we start working together and what kinds of Cloudflare products and services are you leveraging today or maybe ones that you're interested in the future?

Yeah, I've got kind of a funny story I'll tell here about how we I wouldn't say stumbled upon, but how we initiated this relationship.

I was actually reading an RCA that Cloudflare had written back in 2018, and it was circulating the Internet.

And I'll just, I'll say everybody has outages.

I don't want to focus on the RCA, but the RCA was super well written, very transparent RCA, and we appreciate that.

And we take a very similar approach to transparent RCA and really a no fault type of culture here.

But we were commenting about how well this was written, and I started to do some research about Cloudflare, and I was looking on LinkedIn and I noticed that I had I'm a University of Montana alum and I had a fellow alum on LinkedIn that worked at Cloudflare.

So I clicked it and it was a gentleman named Aaron Trott.

So Aaron Trott and I actually were born and raised in the same 150 person town in rural Montana.

Yes, my mother was Aaron Trott's first and second grade teacher.

I was Aaron Trotts religious education, summer camp teacher.

So that's then I go back.

So I reached out to Aaron Trott really not with any notion of creating a business relationship, but just to chat with him.

We talked for the better part of a couple of years.

We followed the success of Cloudflare super compelling and how we were looking at security as well.

But not only security, how we were looking at the infrastructures code, really that infrastructure is code, i.e.

TerraForm was a critical component.

It was really a crucial criteria for us to select a replacement vendor here.

But Aaron and I continued to talk, really was excited about what Cloudflare had to offer as the product matured.

As a company, success year over year became more obvious.

The timing just became right for us.

So we launched this relationship back in July of 2020, really again just shortly after the pandemic, and obviously became customers.

The things that I think we're really excited about, again, I mentioned the pantry of Tools, the pantry of different technologies as a private cloud, multi-cloud type of architecture becomes super operationally difficult to execute upon.

And again, that centralized control plane, that ubiquitous layer, it took a lot of that complexity out for us.

So that was really core.

So I mentioned infrastructures code, the ability to consolidate toolset, a single path, a single firewall was super compelling as well.

But then there's other things obviously.

Zero Trust I know that's a key emphasis on the 2022 roadmap.

We're excited about that.

But we also we're also really excited about linked account prevention.

We're really excited about malicious file upload.

These may not be things that are the biggest items, but there are things that really solve some real needs for us and for our customers.

So we're excited about those things.

But again, we're really in the throes of an all out implementation to move all 20 million account holders behind Cloudflare.

So please, please make sure your services is resilient, is as we need it to be, but also our account holders needed to be.

Yeah.

Well, first of all, fantastic to hear, actually, that you found us through that RCA.

I know that's like an interesting interest story, but I actually am also super proud of the fact that we are super transparent about that stuff on our blog.

That's information that I'll share with candidates who are interested in working at Cloudflare and customers.

I think it's super important and we learned so much by going through that process and also thinking about sort of the extra level of scrutiny that's going to be on stuff that we publish publicly about.

Absolutely.

This is a partnership. We call it partnership with our customers all the time.

And that transparency is a reflection of the partnership.

So we do appreciate that.

But yeah, I mean, that was certainly not the point of the story.

But yes, I think that's something to also be very proud of.

We all have these moments that we're going to learn from them as well.

But yeah, it was it was super appreciated.

Again, I think a reflection of the partnership.

Yeah.

And I mean, it makes total sense to hear that resiliency obviously is top of mind for you, for any vendor that you're thinking about working with any solution, especially one that sort of sits in front of critical infrastructure, that's obviously a very strong focus for us, especially as our business continues to grow and we take on more and more sensitive traffic and larger and larger sort of chunks of the Internet kind of curious about just if you had to describe sort of like opportunities that you see in terms of what actually maybe your customers, your end customers are interested in.

I mean, obviously, they expect a base level of security reliability performance from your infrastructure.

But if there is stuff that you could be excited to tell them that you are implementing across your infrastructure with Cloudflare or just across sort of your security strategy in general, if you could go to your customers and say, hey, your traffic with us is going to be more secure, more reliable, what kinds of stuff would you want to emphasize or what do you excited about?

Yes.

I mentioned a leaked account credential. I mentioned malicious foul up.

Those are two that, again, our customers, especially in the landscape that we're operating in, are very well aware of.

Those are things that we're committing to our customers to go execute on in 2022.

For me, however, I stand in front of customers on a fairly regular basis, and I love the ability to not have to quantify or explain how we're protecting individual environments.

So again, I think that very consistent policy, both network and security policy that this allows us to apply across multiple environments is really it really simplifies our story and allows us to tell this very consistent story that I think, again, our customers all expect.

So again, if you could look at when we think about how do we ensure that all of our environments are leveraging TLS 1.3, we go, we go one place to do that.

And we have a great deal of confidence when we say yes, nothing is using anything less than TLS 1.3 as an example.

So again, just makes this much easier for us to execute on across this very distributed architecture landscape without Cloudflare really sitting over the top.

That probably isn't a story that we're telling. We are really excited about this.

We are telling the story on a regular basis to our clients, where we're going with distributed cloud architecture.

The benefits not only to us but also to them really with the speed of innovation.

At the center of that, I believe, is a very compelling story.

And I believe that's where I think a lot of businesses like us end up here in the next couple of years.

Awesome.

That's amazing to hear. We have just a little bit over a minute left.

I would love to just close out with if you are speaking to I mean, I'm sure some of our listeners, our audience here are folks that are sort of peers of yours or sort of looking up to you in your role.

If you could give advice to other people that are watching, that have a role that's like yours or similar or they're thinking about it, what would you share with them about maybe your experience in your career to help them be successful?

Yeah, I mean, humbly, I feel like I'm learning every day, right?

So I don't know that I'm the oracle here with all the answers, but certainly two ears, one mouth, use them proportionately, I think is always a very good piece of advice.

And I think that again is really part and parcel with just always being a learner.

Embrace change and devote yourself to your craft.

I think definitely a lot of I think our success has come as a result of people just work really, really hard, which probably also then is a really good opportunity to close with hire the right people.

That makes your life a lot easier.

Hire slow, fire fast, I think is generally the term used, but really your life?

My life gets a lot easier when I have the smart people that I have working for me and I have been blessed to have a lot of those people work for me.

So again, we have really talented folks and I would be remiss if I didn't mention that we are also hiring.

So I'm always looking for good talent and always looking to add talent to our staff.